Summary
Viking.DE, a variant of Viking, is a virus that it infects executable files on all available drives and has network spreading capabilities. The virus copies itself into the Windows directory and drops a DLL that downloads and runs files from a website. Viking.DE has a payload - it kills processes belonging to anti-virus and security software.
Removal
Disinfection of the Viking virus-worm should be performed as follows:
Disconnect a computer or local network from the Internet.
Disable network sharing or set strong passwords for all shares.
Select the "Disinfect Automatically" action for F-Secure Anti-Virus real-time scanners on all computers. With "Disinfect Automatically" selected, F-Secure Anti-Virus will disinfect files that a virus tries to infect over a network (if sharing was not disabled).
Scan all files on all drives on all computers and MANUALLY select the "Disinfect" action to disinfect all infected files and to rename the virus droppers. DO NOT select automatic disinfection option after the scan!
Restart all disinfected computers.
Scan all hard drives on disinfected computers again to make sure that no more infected files are left. If needed, repeat disinfection procedure.
Disinfect all infected computers connected on the network.
Enable network sharing, keep strong share passwords.
Reconnect the disinfected computer or local network to the Internet.
Please note that because of the "Worm." detection prefix F-Secure Anti-Virus will suggest to delete infected files, but DO NOT select the "Delete" option because this worm also has a viral component and you don't want to delete all infected files instead of disinfecting them. At the same time, the worm's dropper and downloader files should be deleted from a computer to prevent re-infection. See the names of the dropper and downloader files in the Details section.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First, check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Installation to the System
The first time an infected file is run on a clean system, the virus activates and drops the following files into the main Windows directory:
- Logo1_.exe
- RichDll.dll
The .DLL component is then injected into the EXPLORER.EXE process. The virus also creates a subfolder named \UNINSTALL\ in the main Windows folder and then drops a file named RUNDL132.EXE at that location. The virus creates a startup value for that dropped file in Windows Registry:
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] load=%WinDir%\uninstall\rundl132.exe
Where %WinDir% represents the main Windows folder (usualy C:\Windows\).Viking.DE also adds the following registry entry as a part of its installation:
- [HKLM\SOFTWARE\Soft\DownloadWWW] auto = "1"
The virus creates the following text files where it writes some information related to its activities:
- C:\gamevir.txt
- C:\log.txt
Infection of Files
Viking.DE is a prepending virus that searches for .EXE files on all available fixed hard drives and infects them by writing its body before the original file's body. In order for the host file to be run correctly, Viking.DE creates a backup copy of itself in the current directory as [filename].exe.exe and then drops and executes the original file as [filename].exe. After that, it deletes the uninfected original file and renames the backup file with the original filename. Viking.DE is able to do this with the help of a temporary batch file that it creates in the system's designated temporary folder as $$ad.bat. Viking.DE virus avoids infecting files with the following strings in their paths or filenames:
- \Program Files\
- Common Files
- ComPlus Applications
- Documents and Settings
- InstallShield Installation Information
- Internet Explorer
- Messenger
- Microsoft Frontpage
- Microsoft Office
- Movie Maker
- MSN
- MSN Gaming Zone
- NetMeeting
- Outlook Express
- Recycled
- system
- System Volume Information
- system32
- windows
- Windows Media Player
- Windows NT
- WindowsUpdate
- winnt
Network Spreading Capabilities
The virus also attempts to propagate via network shares by copying itself to the following shared folders:
- admin$
- ipc$
- with the following accounts:
- administrator
- guest
Payload
As a part of the payload, the virus stops the following service:
- "Kingsoft AntiVirus Service"
- and terminates the following processes related to several anti-virus products:
- EGHOST.EXE
- IPARMOR.EXE
- KAVPFW.EXE
- MAILMON.EXE
- mcshield.exe
- RavMon.exe
- RavMonClass
- Ravmond.EXE
- regsvc.exe
The DLL component of Viking.DE virus attempts to download and execute files from Internet.
Protect your devices from malware with F‑Secure Total
Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.
Award‑winning antivirus and malware protection
Online browsing, banking, and shopping protection
24/7 online identity and data breach monitoring
Unlimited VPN service to safeguard your privacy
Password manager with private data protection
Choose how many devices you want to protect to get started.
Free customer support
Cancel anytime
The trial does not obligate you to buy the product
After 30 days your subscription will renew automatically for one year at €69.99.
)
)
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.